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UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


UNITED STATES OF AMERICA, 

Plaintiff, 

v. 

ROCHESTER DRUG CO-OPERATIVE, INC., 
Defendant. 


19 Civ. 3568 ( 

COMPLAINT 


) 


INTRODUCTION 

1. The United States of America brings this civil enforcement action seeking 
penalties and injunctive relief against defendant Rochester Drug Co-operative, Inc. (“RDC”) for 
knowingly failing to comply with its legal duty to report to the Drug Enforcement 
Administration (the “DEA”) suspicious orders of controlled substances, including thousands of 
suspicious orders of oxycodone, fentanyl, hydrocodone, amphetamine, and buprenorphine 
products. RDC was well aware that many of its largest pharmacy customers exhibited “red 
flags” associated with the diversion of controlled substances, but failed to report these customers 
or their orders to the DEA as required. 
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2. RDC, a regional wholesale drug cooperative headquartered in Rochester, New 
York, distributes, among other things, highly-addictive controlled substances to independently- 
owned pharmacies in several states. During the relevant period, RDC was one of the nation’s ten 
largest drug distributors, with over 1,300 pharmacy customers. 

3. Asa distributor of controlled substances, RDC is required to operate a system to 
detect and report to the DEA suspicious orders of controlled substances. See 21 C.F.R. 

§ 1301.74(b). Suspicious orders include “orders of unusual size, orders deviating substantially 
from a normal pattern, and orders of unusual frequency.” See id. 

4. RDC knowingly failed to operate an adequate system to detect, investigate, and 
report to the DEA suspicious orders of controlled substances. Between May 2012 and 
November 2016 (the “Relevant Time Period”), RDC received and fulfilled over 1.5 million 
orders for controlled substances from its pharmacy customers. However, during this period, 

RDC reported a total of only four suspicious orders to the DEA, notwithstanding senior 
management’s awareness of the company’s reporting obligations under the Controlled 
Substances Act (the “Act” or the “CSA”). RDC failed to report to the DEA at least two thousand 
suspicious orders of controlled substances made by its pharmacy customers during the Relevant 
Time Period. RDC’s former Chief Operating Officer has conceded that there was no program in 
place to notify the DEA of suspicious orders and that RDC’s suspicious order reporting system 
was “broken.” 

5. During this period, RDC shipped large quantities of opioids to pharmacies that 
RDC knew exhibited dispensing patterns that suggested the pharmacies were dispensing 
controlled substances for illegitimate medical purposes. RDC not only continued to supply these 
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pharmacies, but also often increased internal purchase thresholds for high-volume customers so 
as to allow these customers to increase their opioid purchases and dispensing over time. 

6. Further, during the Relevant Time Period, RDC failed to devote sufficient 
resources to compliance and operated a woefully inadequate due diligence program to prevent 
the diversion of controlled substances by its pharmacy customers. Indeed, during the early 
portion of the Relevant Time Period, the primary individual responsible for managing the 
company’s compliance program also performed a number of other time-consuming tasks, such as 
managing RDC’s warehouse and tracking inventory. When RDC started to expand its 
compliance unit, the company hired unqualified personnel who lacked necessary qualifications 
and relevant experience. 

7. RDC’s top management, including its former Chief Executive Officer (“CEO”), 
instilled a culture of non-compliance at the company and prioritized attracting business, catering 
to existing customers, and making money above all else. They did not report suspicious orders 
or pharmacy customers to the DEA because they did not want to risk losing revenue from these 
customers. From 2012 through 2016, RDC’s revenue from sales of controlled substances nearly 
quadrupled, and its former CEO earned millions of dollars in compensation as a result. 

JURISDICTION AND VENUE 

8. This Court has jurisdiction over this action pursuant to 21 U.S.C. §§ 842(c)(1) and 
843(f)(2), and 28 U.S.C. §§ 1345 and 1355. 

9. Venue is proper in the Southern District of New York pursuant to 21 U.S.C. 

§ 843(f)(2) and 28 U.S.C. §§ 1391(b) and 1395(a). 

PARTIES 

10. Plaintiff is the United States of America. 
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11. Defendant RDC is a pharmaceutical distributor headquartered in Rochester, New 
York. RDC engages in the interstate distribution of, among other things, controlled substances 
as defined under the Act, pursuant to a registration number issued by the DEA. See 21 U.S.C. 

§ 802(6); 21 C.F.R. § 1308.12. In 2015, RDC entered into a Consent Decree with the United 
States in which it admitted that it had: failed to report any electronic distribution transactions to 
the DEA through the DEA’s Automation of Reports and Consolidated Orders System 
(“ARCOS”) reports; and failed to include theft and significant loss data in its DEA ARCOS 
reports. 

REGULATORY BACKGROUND 

12. Drugs and other substances that are considered controlled substances under the 
CSA are divided into five “schedules,” generally designated by Roman numerals I through V. 
Schedule II controlled substances, as defined under the Act, are drugs that have a currently 
accepted medical use in the United States, but also a high potential for abuse, which may lead to 
severe psychological or physical dependence. See 21 U.S.C. § 812(b)(2). 

13. To combat the high potential for abuse of Schedule II controlled substances, the 
Act creates a distribution monitoring system for those authorized to handle controlled 
substances, at the heart of which are registration, tracking, and reporting requirements. The Act 
mandates strict adherence to a number of these requirements by any person or entity that 
distributes controlled substances. 

14. A distributor is a person or an entity that delivers (other than by administering or 
dispensing) a controlled substance. Delivery is the actual, constructive, or attempted transfer of 
a controlled substance. See 21 U.S.C. §§ 802(8), (11). 
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15. Distributors are required to maintain effective controls and procedures to guard 
against theft and diversion of controlled substances. See 21 C.F.R. § 1301.71. In determining 
whether a distributor has provided such effective controls, the DEA looks to whether the 
distributor has implemented the physical and operational security requirements outlined in 

21 C.F.R. §§ 1301.72- 1301.76. 

16. Among these physical and operation security requirements is the requirement that 
a distributor report suspicious orders of controlled substances. See 21 C.F.R. § 1301.74(b). 
Specifically, distributors must design and operate a system to disclose suspicious orders of 
controlled substances, and report any discovered suspicious orders to the DEA. See id. 
Suspicious orders include “orders of unusual size, orders deviating substantially from a normal 
pattern, and orders of unusual frequency.” Id. 

17. RDC was aware of these obligations. Prior to the Relevant Time Period, on or 
about September 27, 2006 and December 27, 2007, the DEA sent letters to all DEA-registered 
distributors of controlled substances, including RDC, that discussed the requirements of 

21 C.F.R. § 1301.74(b) and contained guidance for the identification and reporting of suspicious 
orders to the DEA (the “2006 Letter” and the “2007 Letter,” collectively the “DEA Letters”). 

The 2006 Letter, inter alia, set forth characteristics that the DEA believed are present in 
pharmacies engaged in diverting controlled substances. The 2007 Letter reiterated the 
responsibilities of distributors, such as RDC, concerning reporting suspicious orders in 
accordance with 21 C.F.R. § 1301.74(b). It also stated that a distributor “need not wait for a 
‘normal pattern’ to develop over time before determining whether a particular order is 
suspicious. The size of an order alone, whether or not it deviates from a normal pattern, is 
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enough to trigger the registrant's responsibility to report the order as suspicious.” See 2007 
Letter. 

18. Pursuant to 21 U.S.C. § 842(a)(5), it is unlawful for a distributor to refuse or 
negligently fail to make or keep suspicious order reports. Any person who violates this provision 
shall be assessed a penalty not to exceed $10,000 for violations on or before November 2, 2015, 
and $15,040 for violations after November 2, 2015. See 21 U.S.C. § 842(c)(1)(B); 

28 C.F.R. § 85.5. 

STATEMENT OF FACTS 

A. RDC’s Business Structure 

19. RDC is a regional distributor of drugs and healthcare products to approximately 
1,300 independently-owned pharmacies in several states. RDC is a DEA-registered distributor 
of Schedule II through V controlled substances under the CSA. 

20. RDC focuses on serving smaller, community-based retail pharmacies, as opposed 
to large drugstore chains. 

21. RDC operates distribution centers in Rochester, New York and Fairfield, New 
Jersey. The Fairfield facility opened in 2015. 

22. RDC’s controlled substances sales grew dramatically over the Relevant Time 
Period. Several of RDC’s top customers were among the pharmacies that dispensed the most 
opioids in the State of New York. According to its website, RDC is now the seventh largest 
distributor of drugs in the United States. 

23. RDC is a stock cooperative with approximately 310 shareholders. The 
corporation’s largest pharmacy customers are its shareholders. During the Relevant Time 
Period, approximately 75% of the company’s sales were to its shareholders. 
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24. On an annual basis, RDC makes distributions, as determined by its Board of 
Directors, to its shareholder pharmacy customers. RDC calculates each pharmacy’s distribution, 
referred to as a “patronage dividend,” based on the amount of drugs and other products that the 
pharmacy purchased from RDC during the year. 

25. Accordingly, the pharmacies that purchase the most from RDC receive the 
largest patronage dividend payments each year. For example, in fiscal year 2015, RDC’s total 
patronage dividend distributions were $31,068,406. Its largest pharmacy customer during the 
Relevant Time Period, which was based in Woodbury, New York, received $10,567,921 in 
patronage dividends. This pharmacy was one of the nation’s top dispensers of Subsys, a highly- 
addictive fentanyl spray, and was also a large provider of oxycodone. 

B. RDC’s Failure to Report Thousands of Suspicious Orders of Controlled 
Substances to the DEA 

26. RDC knowingly failed to implement an adequate system to detect, investigate, 
and report suspicious orders of controlled substances. RDC failed to report to the DEA 
thousands of orders of controlled substances made by its pharmacy customers that should have 
been reported as suspicious pursuant to the criteria set forth in 21 C.F.R. § 1301.74(b) and the 
guidance contained in the DEA Letters. As a result, RDC impeded the DEA’s ability to identify 
and prevent the illicit dispensing of highly-addictive controlled substances by several of RDC’s 
pharmacy customers. 

27. RDC’s Chief Operating Officer during the Relevant Time Period admitted that the 
company did not have a functional system to comply with its legal obligations to report 
suspicious orders. When questioned by DEA agents in 2017, he acknowledged that there was no 
program in place to notify the DEA of suspicious orders and that the company’s suspicious order 
reporting system was “broken.” 
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28. During the Relevant Time Period, RDC received and fulfilled over 1.5 million 
orders for controlled substances, including hundreds of thousands of orders for highly-abused 
drugs, such as oxycodone, fentanyl, and hydrocodone. RDC reported a total of only four 
suspicious orders to the DEA during this entire period. 

29. Several of RDC’s largest pharmacy customers exhibited ordering patterns that 
suggested that the pharmacies, and/or certain physicians who prescribed drugs dispensed by the 
pharmacies, were engaging in opioid diversion. RDC failed to maintain effective controls to 
prevent such diversion and failed to report frequent unexplained sharp spikes in opioid orders. 

30. Through its review of dispensing data, on-site customer visits, and other sources, 
RDC internally frequently identified red flags suggesting that its pharmacy customers were 
dispensing controlled substances that were not for legitimate medical purposes. For instance, 
several of RDC’s largest pharmacy customers exhibited the following dispensing patterns: 

i. A high percentage of the pharmacy’s controlled substance sales, 
and particularly sales of oxycodone 30-milligram tablets, were 
paid for in cash as opposed to through insurance. Oxycodone 30- 
milligram tablets are the most commonly abused form of 
oxycodone. 

ii. An usually high proportion of the pharmacy’s overall dispensing 
consisted of controlled substances. 

iii. A disproportionate percentage of the pharmacy’s controlled 
substance purchases were for highly-abused drugs, such as 
oxycodone 30-milligram tablets or fentanyl patches or spray. 

iv. The pharmacy filled prescriptions for controlled substances for 
many patients who lived great distances from the pharmacy. 

v. The pharmacy frequently filled prescriptions for quantities or 
dosages of controlled substances that were higher than accepted 
medical standards. 
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Notwithstanding these red flags, RDC continued to sell large quantities of controlled substances 
to these pharmacies and did not file suspicious order reports with the DEA. 

31. RDC’s internal files reveal numerous instances where compliance personnel 
identified pharmacy customers that were engaging in alarming dispensing practices. For 
example: 


• In a February 2013 e-mail, a contractor who conducted pharmacy audits 
advised RDC management that the amounts of opioids being dispensed by 
two pharmacy customers were “very high and the average quantity 
dispensed is like a stick of dynamite waiting for DEA to light the fuse.” 
The contractor specifically reported that these pharmacies were filling 
high quantities of oxycodone 30 mg. 

• After reviewing a pharmacy customer’s dispensing data from 
October 1, 2013 through January 29, 2014, RDC compliance personnel 
found that 88% of the pharmacy’s oxycodone 30 mg sales were paid for in 
cash and that its top physician prescribers were located outside the state 
where the pharmacy was located. 

• In September 2015, an RDC employee sent an email to RDC’s 
Compliance Specialist noting that she was going to continue to review the 
latest dispensing report from a large pharmacy customer “and what evil 
lies within.” 

• In November 2015, after reviewing a pharmacy customer’s recent 
dispensing activity, RDC’s Compliance Specialist wrote in an internal 
email: “They are a secondary account with us who went from on average 
for the last 6 months ordering 15380 units to ordering a staggering 28,600 
units last month which makes my stomach sick. . . . They have multiple 
prescribers using inactive/not found/not belonging to them DEA 
registration numbers. They have multiple doctors on Watch list. Multiple 
doctors writing for high dosages of Oxy 30mg, Cocktail prescribing, some 
from 80 miles plus away. Few out of state doctors as well. Some under 
disciplinary review restricted from practicing medicine in NY State.” 

• In June 2016, after conducting a review of one of RDC’s largest pharmacy 
customers, compliance personnel issued a report concluding that the 
pharmacy, which had represented to RDC that controlled substances were 
primarily dispensed to cancer patients, was “engaging in dispensing 
activity that is of high risk, by filling a [sic] high amounts of opioid 
controlled substances prescriptions written for high dosage units for non¬ 
cancer patients.” The report further noted that “the pharmacy is seemingly 
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violating the tenets of its own due diligence policies, protocols and 
business mandate, by filling questionable prescriptions written by 
prescribers who are primarily treating patients for non-cancerous pain 
management, as opposed to those being treated for cancer related pain.” 

In each of these instances, RDC had a clear basis to suspect its customers might be engaging in 
opioid diversion but declined to report any of the pharmacy’s orders or the pharmacy to the 
DEA. 

32. RDC also maintained an internal list that identified specific physicians who had 
been arrested, investigated by state or federal government agencies, subject to state 
administrative proceedings, or whom RDC compliance personnel had identified as engaging in 
suspicious prescribing activities (“Watch List”). Several of RDC’s biggest pharmacy customers 
filled large volumes of prescriptions written by physicians on the Watch List. RDC continued to 
sell controlled substances to these pharmacies well after placing the physicians on the list. 

33. RDC’s failure to detect and report suspicious orders placed by its pharmacy 
customers deprived the DEA of valuable information concerning potentially diverted controlled 
substances. 


C. RDC’s Routine Fulfillment of Orders that Exceeded Customer Limits and Its 
Failure to Report Such Orders to the DEA 

34. RDC developed and implemented a system that automatically generated an alert 
each time a pharmacy customer’s order for a drug in a particular controlled substance category 
exceeded the monthly purchase threshold that RDC had established for drugs in that category. 
RDC referred to such orders as “orders of interest.” 

35. The monthly thresholds were calculated based on a multiple of the pharmacy 
customer’s average purchases of the relevant drugs over the preceding 12 months. Accordingly, 
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for a customer’s drug purchases to exceed the monthly threshold, there would need to have been 
a significant spike in the customer’s ordering of the relevant drugs during that month. 

36. Pursuant to its written policies, RDC was not supposed to fill an “order of 
interest” until it had completed an investigation into the increase in the customer’s controlled 
substances order volume and had determined whether the order was consistent with legitimate 
business practices or should be deemed to be “suspicious.” 

37. RDC’s system identified approximately 7,800 “orders of interest” from January 
2013 through the end of the Relevant Time Period. However, RDC did not comply with its own 
policies after flagging these orders. The company filled nearly all of the approximately 7,800 
“orders of interest,” usually without conducting the required investigation or taking necessary 
steps to determine whether there was a legitimate explanation for the significant spike in the 
customer’s order volume. RDC rarely contacted the pharmacy that placed the “order of interest” 
to obtain the reason for the spike in ordering and regularly failed to obtain updated controlled 
substance dispensing information from the customer. 

38. RDC also did not report any of the approximately 7,800 “orders of interest” to the 

DEA. 

39. Instead, rather than report these orders or limit sales to pharmacies that placed 
“orders of interest,” RDC routinely raised the purchase thresholds for high-volume customers. 
This prevented the generation of future “orders of interest” and allowed these customers to 
continue to increase their opioid purchases and dispensing over time. RDC prioritized 
maximizing its sales and revenues above complying with its own policies and DEA reporting 
requirements. 
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D. RDC’s Inadequate Due Diligence Program 

40. RDC failed to implement an adequate due diligence program to prevent the 
diversion of controlled substances by its pharmacy customers. 

41. RDC did not devote sufficient resources to compliance. Indeed, during a portion 
of the Relevant Time Period, the primary individual responsible for managing compliance also 
performed a number of other time-consuming tasks, such as managing RDC’s warehouse and 
tracking inventory. 

42. Even when RDC started to expand its compliance unit, the company hired 
unqualified personnel who lacked necessary qualifications and relevant experience. For 
example, in 2015, RDC hired the daughter of the company’s General Manager to serve as a 
“Compliance Specialist,” even though she lacked any prior pharmaceutical compliance 
experience. 

43. RDC failed to implement adequate on-boarding procedures to assess whether 
prospective new customers might be engaging in diversion. In its rush to enroll new customers 
and increase revenues, RDC frequently began selling controlled substances to pharmacies 
without first conducting due diligence on the pharmacy’s operations, background, and recent 
dispensing patterns. Further, RDC’s sales staff were involved in screening and approving new 
customers despite the fact that they were compensated for each new customer enrolled and thus 
had a financial incentive to ignore indicia of potential diversion activities. 

44. RDC also failed to conduct appropriate due diligence of its existing controlled 
substance customers to guard against diversion. Most of RDC’s pharmacy customers were not 
subject to on-site compliance visits. Further, RDC failed to consistently obtain and review recent 
and complete pharmacy dispensing reports that would have allowed it to better detect troubling 
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patterns, such as the dispensing of unusually large amounts of highly-addictive opiates to 
individuals. 

45. Moreover, as discussed above, even when compliance personnel identified red 
flags based on-site visits or dispensing data, RDC management ignored these red flags, 
continued to supply the phannacy with controlled substances, and did not report the red flag or 
any of the pharmacy’s suspicious orders to the DEA. 

E. RDC’s Management Ignored Their Reporting Obligations and Created a 
Culture of Non-Compliance 

46. RDC’s management created a company culture that discouraged reporting 
information to the DEA. RDC’s culture of silence was driven by its desire to attract business and 
cater to its clients. 

47. This ethos is exemplified by an internal September 2015 e-mail exchange. RDC’s 
Compliance Specialist reported to her supervisor that she was uncomfortable with an RDC 
customer that continued to fill prescriptions paid for in cash and written by doctors who had been 
deemed suspicious. Her supervisor responded, “[i]f you are to report someone to the DEA due to 
the high cash you would have to follow that for all our customers, but we choose as Independent 
Wholesaler to educate and work with our customers. This is what RDC is all about and I know 
you know that.” Although RDC ultimately stopped supplying this pharmacy, it never reported 
the pharmacy or any of its suspicious orders to the DEA. 

48. The principle of catering to its clients, no matter their behavior, came from the 
very top of the company. In September 2014, RDC’s former CEO encouraged RDC’s 
Compliance Auditor at the time to visit a potential new client over the objections of the 
Compliance Auditor who protested moving forward because the pharmacy was “not even ... on 
the borderline in terms of proper compliance standards.” Nevertheless, RDC’s former CEO 
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instructed the Compliance Auditor to visit the store, noting that “we are the knight in shining 
annor for [sic] Independents” and that RDC “should do all we can to support them.” 

49. This culture also led RDC to continue to supply controlled substances to 
pharmacies after other distributors had cut them off due to diversion concerns. For instance, one 
of RDC’s biggest customers had previously been cut off by another distributor due to its 
suspicious ordering of oxycodone and hydrocodone. Nevertheless, RDC shipped large amounts 
of controlled substances to this Pennsylvania-based pharmacy despite glaring red flags, including 
the fact that over half of the pharmacy’s customers used cash to purchase controlled substances. 

50. Similarly, RDC continued to supply controlled substances to another pharmacy 
well after a different distributor had suspended controlled substance sales to that pharmacy based 
on concerns that it was fdling prescriptions written by doctors who were suspected drug- 
diverters. 

51. RDC rarely stopped supplying drugs to its pharmacy customers, regardless of how 
much information existed suggesting that the pharmacy was dispensing controlled substances for 
illegitimate purposes. In fact, while RDC had over 1,300 customers, it only terminated its 
relationship with seventeen customers during the Relevant Time Period. Of those seventeen 
customers, six were terminated for reasons unrelated to suspected drug diversion and one was 
not terminated until well after the Government began its investigation. Instead, RDC continued 
to supply customers with controlled substances for months or years after encountering substantial 
evidence that the drugs those pharmacies dispensed were being used illicitly. 

CAUSE OF ACTION 

(Failure to Report Suspicious Orders - Multiple Violations) 

52. The Unites States incorporates by reference each of the preceding paragraphs as if 

fully set forth herein. 
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53. During the Relevant Time Period, RDC failed to design and operate a system to 
disclose suspicious orders of controlled substances and report suspicious orders to the DEA 
when discovered, in violation of the requirements codified at 21 U.S.C. § 842(a)(5) and 

21 C.F.R. § 1301.74(b). 

54. RDC violated 21 U.S.C. § 842(a)(5) and 21 C.F.R. § 1301.74(b) on multiple 
occasions, with the precise number of violations to be established at trial. 

55. Each violation set forth above is subject to a penalty as provided under 21 U.S.C . 
§ 842(c). 

WHEREFORE, the United States respectfully requests judgment to be entered in its 
favor and against RDC as follows: 

(a) A sum equal to civil penalties to the maximum amount allowed by law; 

(b) Appropriate injunctive relief pursuant to 21 U.S.C. § 843(f); and 

(c) Granting the United States such further relief as the Court may deem proper. 

Dated: New York, New York 

April 23,2019 


GEOFFREY S. BERMAN 
United States Attorney 
Southern District of New York 
Attorney for the United States of America 


By: /s/ Jeffrey K. Powell 

JEFFREY K. POWELL 
JACOB M. BERGMAN 
Assistant United States Attorneys 
86 Chambers Street, 3 rd FI. 

New York, New York 10007 
Tel. (212) 637-2706/2776 
jeffrey.powell@usdoj .gov 
jacob.bergman@usdoj.gov 
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